125 matches found
CVE-2015-3655
Cross-site request forgery CSRF vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token...
Cross-site Request Forgery (CSRF)
teampass is vulnerable to a cross-site request forgery CSRF attacks. The library does not use an anti-csrf token to prevent cross-site request forgery, allowing a malicious user to trick an authenticated user to execute malicious action on their behalf...
Cross-Site Request Forgery
Cross Site Request Forgery CSRF occurs when an authenticated user is tricked into clicking on a link which would automatically submit a request without the user's consent. This can be made possible when the request does not include an anti-CSRF token, generated each time the request is visited an...
Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass Persistent Cross-Site Scripting
Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass Persistent Cross-Site Scripting Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin Date: 15-10-2016 Software Link: http://www.subrion.org/download/ Vendor: http://www.subrion.org Google Dork: "Powered by Subrion CMS...
Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass / Persistent Cross-Site Scripting
Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin Date: 15-10-2016 Software Link: http://www.subrion.org/download/ Vendor: http://www.subrion.org Google Dork: "Powered by Subrion CMS" Exploit Author: Ahsan Tahir Contact: https://twitter.com/AhsanTahirAT |...
Subrion CMS 4.0.5 Cross Site Request Forgery / Cross Site Scripting
Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin Date: 15-10-2016 Software Link: http://www.subrion.org/download/ Vendor: http://www.subrion.org Google Dork: "Powered by Subrion CMS" Exploit Author: Ahsan Tahir Contact: https://twitter.com/AhsanTahirAT |...
CumulusClips 2.4.1 Code Execution / CSRF / Cross Site Scripting
Exploit Title: CumulusClips Session fixation Google Dork: inurl:/cumulusclips/videos/ Date: 2.09.2016 Exploit Author: kor3k / Aukasz Korczyk Vendor Homepage: http://cumulusclips.org/ Software Link: http://cumulusclips.org/cumulusclips.zip Version: 2.4.1 Tested on: Debian Jessie Description:...
Concrete CMS: ProBlog 2.6.6 CSRF Exploit
Report Because the ProBlogs plugin did not validate the anti-csrf token on a POST request. A victim who is logged in could be fooled into clicking a malicious form styled to look like a link, image, etc which would create a page in their C5 website. Because the ProBlogs plugin does not validate t...
WordPress leenk.me 2.5.0 Cross Site Request Forgery / Cross Site Scripting
I would like to disclose CSRF and stored XSS vulnerability in Wordpress plugin LeenkMe version 2.5.0. The plugin can be found at https://wordpress.org/plugins/leenkme/ In the page wp-content/plugins/leenkme/facebook.php XSS vulnerable Fields are : - facebookmessage - facebooklinkname -...
WordPress leenk.me 2.5.0 Plugin - Cross-Site Request Forgery / Cross-Site Scripting
Exploit for php platform in category web applications I would like to disclose CSRF and stored XSS vulnerability in Wordpress plugin LeenkMe version 2.5.0. The plugin can be found at https://wordpress.org/plugins/leenkme/ In the page wp-content/plugins/leenkme/facebook.php XSS vulnerable Fields a...
WordPress Plugin leenk.me 2.5.0 - Cross-Site Request Forgery Cross-Site Scripting
WordPress Plugin leenk.me 2.5.0 - Cross-Site Request Forgery Cross-Site Scripting I would like to disclose CSRF and stored XSS vulnerability in Wordpress plugin LeenkMe version 2.5.0. The plugin can be found at https://wordpress.org/plugins/leenkme/ In the page...
DigitalSellz: The product/status method CSRF
When we use the "on/off" buttons to set the products to be shown on the products page, a POST-request to https://www.digitalsellz.com/product/status is sent with only the product id as a parameter no other security tokens. So the idea is to make my rival visit a web page with a code like this:...
W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery (CSRF)
The plugin does not validate the 'wpnonce' anti-CSRF token. This issue can be used to perform many actions. The most significant action with the biggest impact is the ability to redirect users to malicious websites. Functionality exists where specific user agent strings can be configured to be...
Netsparker v3.5 - Web Application Security Scanner
Netsparker Web Application Security Scanner can find and report web application vulnerabilities such as SQL Injection and Cross-site Scripting XSS and security issues on all web applications and websites regardless of the platform and the technology they are built on. Netsparker is very easy to u...
Axous 1.1.1 - Multiple Vulnerabilities (CSRF - Persistent XSS)
No description provided by source. +-----------------------------------------------------------------------------------------------------------+ Exploit Title : Axous 1.1.1 Multiple Vulnerabilities CSRF - Persistent XSS Date : 30-04-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software...
Wordpress 3.3.1 - Multiple CSRF Vulnerabilities
No description provided by source. +---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Wordpress 3.3.1 Multiple CSRF Vulnerabilities Date : 19-03-2012 Author : Ivano Binetti...
Slack: State parameter missing on google OAuth
Hi, State parameter i.e anti-csrf token to prevent session hijacking attacks is missing on Google OAuth i.e...
Joomla! JomSocial component < 3.1.0.1 - Remote code execution
------------------------------------------------------------- Joomla! JomSocial component 3.1.0.1 - Remote code execution ------------------------------------------------------------- == Description == - Software link: http://www.jomsocial.com/ - Affected versions: All versions = 2.6 and 3.1.0.1...
CVE-2013-2628
Multiple cross-site request forgery CSRF vulnerabilities in action.php in Leed Light Feed, possibly before 1.5 Stable, allow remote attackers to hijack the authentication of administrators for unspecified requests, related to the lack of an anti-CSRF token...
CVE-2013-2628
Leed (Light Feed) contains CSRF vulnerabilities in action.php (CVE-2013-2628), likely present before 1.5 Stable. The issue arises from missing anti-CSRF tokens, allowing an attacker to perform actions as a logged-in administrator by inducing the admin to visit a malicious link or site. The CSNC a...